[larsvikb]

What

Task 61, plan 14. Two small fixes on the v11 migration (#202).

• SchemaVersionTests._v10_store gains a rule scoped to mcp, id 3,
  pattern tools.test. Every other fixture rule has the legacy class,
  which is also the column's default, so a v11 that left client_class
  out of the copy refilled every row with the default and looked
  unchanged. Only test_an_unstamped_store_past_a_step_is_placed_not_re_run
  caught that, and only by passing through v11. The new pattern is one no
  legacy row uses, so under that mutation the copy succeeds and the class
  assertion fails, rather than UNIQUE(pattern, client_class) erroring
  every test. Id 3 fills a gap below 5, so "the next id after revoking
  the highest is 6" keeps its meaning.
• test_v11_rebuilds_both_policy_tables_keeping_each_rule_under_its_id
  reads each rule back with its class, and checks that policy decides
  tools.test as allow for mcp and as hold for the legacy class.
• test_a_failed_v11_leaves_both_policy_tables_as_they_were has an
  id list per table, since rules now has three rows.
• _step_1_client_class's docstring gives the old reason again, in
  step 1's terms. The step builds the new table under a temporary name and
  renames it, so a shared DDL string would have needed the table name as a
  parameter, and that is how rules_migrating would reach a fresh store's
  schema. Never reuse a rule id, so a stale edit cannot land on a newer rule #202 had replaced this with "a step keeps doing what it did when
  it shipped", which v11 next to it does not do. The true part stays: v11's
  rebuild from _RULES_DDL is what makes a migrated store and a fresh one
  agree. This changes the docstring only, and step 1's body stays as it
  was.

The plan's line references and fixture ids, written against bc941bf,
still match main at 11feae5.

Checked

• make lint, make consistency and make test pass.
• Mutation: v11 copies rules without client_class. Two failures
  in test_control_plane_api.py, both assertions with no errors: the
  strengthened v11 test, at the rules-list assertion ((3, 'tools.test', 'allow', 'sandbox') != (3, ..., 'mcp')), and the unstamped-store test
  that caught it before. Restored.
• Mutation: v11 copies rules without id (Never reuse a rule id, so a stale edit cannot land on a newer rule #202's mutation). The
  strengthened v11 test fails on its rules-list assertion, with ids 1, 2, 3
  in place of 2, 3, 5. Restored.
• The other _v10_store tests pass with the extra row. I re-read each
  of their assertions, not just their result.
• Nothing needs the host.

Generated with Claude Code